CVE-2026-66006: lakeFS Unauthenticated Operator Metadata Overwrite via setup_comm_prefs

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-07-24 · updated 2026-10-24
Weakness: CWE-306

Description

lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setup_comm_prefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name, and company after setup completion. Attackers can POST to this endpoint to modify security update preferences, disable security communications, and trigger falsified telemetry events using the legitimate installation ID.

Affected products

treeverse lakeFS: through 1.83.0

References

https://github.com/treeverse/lakeFS/commit/71a45eeb1639d146d34b8effd7e86d077160ed7c
https://github.com/treeverse/lakeFS/issues/10465
https://github.com/treeverse/lakeFS/pull/10499
https://www.vulncheck.com/advisories/lakefs-unauthenticated-operator-metadata-overwrite-via-setup-comm-prefs

Get alerted when CVE-2026-66006 or the next vulnerability affects your stack